Skip to content
Briefcase AI

briefcase.compliance

Terminal window
pip install briefcase-ai[compliance]

Builds a tamper-evident bundle that reproduces a routing decision together with the policy version and evidence records in effect at the decision’s transaction time. Integrity is protected by a SHA-256 content hash; verify() raises if the bundle was altered.

ExaminerBundle

from datetime import datetime, timezone


from briefcase.bitemporal import BitemporalRecord, InMemoryBitemporalStore
from briefcase.routing import PolicyRegistry, PolicyVersion, PolicyRule, AgentRouter
from briefcase.compliance import ExaminerBundle, BundleIntegrityError


store = InMemoryBitemporalStore()
now = datetime.now(timezone.utc)


evidence = BitemporalRecord.new(
    key="config:max_retries",
    valid_time=now,
    value=3,
    source="config-service",
)
store.append(evidence)


registry = PolicyRegistry()
policy = PolicyVersion(
    policy_id="ticket-routing",
    version="1",
    rules=[PolicyRule(rule_id="gold-tier", condition={"tier": "gold"}, choice="priority-queue")],
    default_choice="standard-queue",
)
registry.publish(policy, valid_from=now)


router = AgentRouter(registry, use_case="ticket-routing", policy_id="ticket-routing")
decision = router.route({"tier": "gold"}, evidence_refs=[evidence.record_id])


bundle = ExaminerBundle.build(decision, store, registry)
print(bundle.content_hash)           # "sha256:..."
bundle.verify()                      # raises BundleIntegrityError if tampered


restored = ExaminerBundle.from_json(bundle.to_json(indent=2))
restored.verify()
ExaminerBundle.build(decision, evidence_store, policy_registry, *,
                     as_of_transaction_time=None, metadata=None) -> ExaminerBundle
  .verify()                # raises BundleIntegrityError
  .to_json(*, indent=None)
  .from_json(s)
  .to_dict() / .from_dict(d)
  .content_hash           # SHA-256

evidence_refs must contain the record_id of each evidence record in the store.

SignedExaminerBundle

Install briefcase-ai[compliance-kms]. Signature verification requires the caller to pass the expected KMS key ID and algorithm; serialized bundle fields are never used as the trust anchor.